Analysis
- user interaction
yes - max time kernel
148s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 21:09
General
- Target ratonClient.exe
- Size 2.4MB
- Sample260705-zzswcsfx5x
- SHA256 84eec6e57783b54191ee477646883cadeaf6a953098a63c3bd94e8635222b2f8
Malware Config
Extracted
-
ratonrat
-
Free
-
zdxpo-2a02-2f01-7c05-c700-39ac-5c45-c497-db77.run.pinggy-free.link:34571
-
nbj4RaCnZCmvNfKmcqY06JG
-
assist
false
-
box
false
-
box_icon
No icon
-
box_msg
Hello, i'm the description of your raton client message box
-
box_title
Hello, im a title for your message box
-
defender
false
-
delay
0
-
hide_file
true
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_LdTm38Sh2pLNKBZ6nhZJa0cxAcW9sv.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
ratonClient.exe
cleanup_LdTm38Sh2pLNKBZ6nhZJa0cxAcW9sv.bat
memory/4180-26-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4180-0-0x00007FF8035FF000-0x00007FF803600000-memory.dmp
memory/4180-1-0x00000225338B0000-0x0000022533B1A000-memory.dmp
memory/4180-59-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4180-58-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4180-57-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4180-47-0x000002254E2B0000-0x000002254E2BA000-memory.dmp
memory/4180-48-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4180-30-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-87-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-93-0x000001CDA03D0000-0x000001CDA03F2000-memory.dmp
memory/4864-84-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-85-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-86-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-83-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-89-0x000001CDA0370000-0x000001CDA037A000-memory.dmp
memory/4864-90-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-88-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-91-0x000001CDA0440000-0x000001CDA04F4000-memory.dmp
memory/4864-92-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-61-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-94-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-96-0x000001CDA0600000-0x000001CDA061A000-memory.dmp
memory/4864-95-0x000001CDA0640000-0x000001CDA0672000-memory.dmp
memory/4864-98-0x00007FF803470000-0x00007FF803E14000-memory.dmp
memory/4864-99-0x000001CDA0620000-0x000001CDA0636000-memory.dmp
memory/4864-100-0x000001CDA0420000-0x000001CDA042E000-memory.dmp
memory/4864-101-0x000001CDA0840000-0x000001CDA0874000-memory.dmp
memory/4864-102-0x000001CDA0800000-0x000001CDA0814000-memory.dmp
memory/4864-103-0x000001CDA0820000-0x000001CDA0832000-memory.dmp